zekakasaai[.]net

Analysis as of July 24, 2026 indicates that the domain zekakasaai.net was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers annalise.ns.cloudflare.com and jaxson.ns.cloudflare.com resolve the domain to the IP address 172.67.143.173, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed for the domain, suggesting that HTTPS was not configured at the time of capture. The site presented the title “ZekaKasa AI – Resmi Platform | AI Ticaret 2025 | 10.000'den Fazla Yorum”, and intelligence tags it as a brand‑impersonation campaign targeting the brand argent.

VirusTotal recorded detections from 2 of 93 scanning engines, and the domain is listed on a single security blocklist, currently blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. The infrastructure appears to rely on Cloudflare’s services, a pattern frequently observed in short‑lived impersonation operations. The domain’s status is marked offline, limiting immediate exposure, but the page title and brand‑targeting metadata suggest the site was intended to lure victims seeking AI‑related services under the guise of a legitimate platform.

Defenders should continue to monitor the IP address 172.67.143.173 for any re‑use, enforce outbound filtering for the domain name, and add the domain to internal blocklists. Threat hunters may also query Cloudflare’s DNS logs for related sub‑domains or similar registration patterns. Because the site was taken down, no HTTP response code or content was captured, leaving the exact malicious payload unknown. Further investigation should focus on retrieving archived snapshots, if any, and correlating the registration identifier with other observed malicious domains to uncover potential campaign infrastructure.